paustint

This is what I found regarding how it happened, but still not a full explanation - but there was some name confusion and obvious incompetence.

>According to eMudhra, proper strong keys were created in the HSM at the key ceremony on 30-04-2025. The script had been changed to test wrapping and unwrapping keys, because the intermediates were to be moved to data centres in the US and Europe, and a bug in that change created a second set of weak keys. The keys had almost identical names, and the weak ones were used for the certificate requests. The same request was signed by eMudhra's own root and sent to Sectigo, which cross-signed it. The strong keys never made it into any certificate (Bugzilla).

https://www.fairssl.se/en/articles/emudhra-ca-noegler-knaekk...

When looters smash the glass door, it's pretty obvious the vulnerability has been there for YEARS!

Disagree - wealthy people don't become wealthy by giving all their money to the government. Expensive cars generally retain a decent value, but the taxes paid evaporate.

Many people don't relocate, but instead try to figure out a way to save a bunch of money on a large purchase - why pay more if it can be avoided?

California is over-regulated and over taxed, "the government knows best, give us all your money and we will take care of you and save the planet". Just leave people alone and let them have a good life and do what they want within reason without trying to suck the life out of every penny.

As a consumer, I use BetterStack's MCP server pretty much daily to search server logs and resolve reported errors - super helpful! But a CLI would be equally useful here.

WAT is the landing page all about, my brain can't process it. I had to close the tab after 10 seconds as I got immediate anxiety.

VSCode also allows staging/unstaging specific hunks by hovering over the hunk near the left/right separator in diff view - super handy when I need it!

Agree it is a pain. I have been using nx and it handles all that for you, playwright is a separate project with it's own twconfig and they all inherit from a root tsconfig.

I prefer nx for single applications and move shared code to "libraries" (I use non-buildable libs). It's pretty sweet for larger projects.

If SpaceX, OpenAI, and Anthropic get fast tracked to be on NASDAQ or S&P 500 then they are required to be included in index funds which will be automatically included in retirement accounts and that will give investors an exit.

https://youtu.be/yhRjvX_t4hc?si=N-a-s_5ttWKfVeJZ

On the flip side I retrained myself to ask llm questions on my phone or computer browser search bar with the expectation of getting an llm response toy question with no desire to look at anything else.

If I truly want to search I will ignore the llm results, but I like the convenience of a quick llm search that knows "all the things". I get the answer to my question without searching multiple ad-ridden websites (since the ad provider does all the things)

I have a choice and have not moved to codex (100/mo personal + my employer pays for a subscription). I try codex here and there and it seems to go off the rails every time. I have had some good experiences with codex, but generally trying to get something big accomplished it doesn't work out.

But I may not have paid enough to get the full real experience with codex

I had a ton of issues with my Macbook pro M1 16GB, memory pressure would be in the yellow always and into red frequently which caused sound stutter and all sorts of issues.

My M1 air (I think 8GB?) had similar issues My M2 24gb was amazing - especially since it allowed dual monitors. I recently upgraded to the M4 32GB and it is my "do everything" computer and is absolutely awesome.

My personal experience with the m-series is that get as memory as possible. I do feel the M1 had issues based on the couple I owned.

EDIT: Even on 32GB my memory pressure is constantly in the yellow, but have not seen it go to red

refined.blog doesn't work, goes to a GoDaddy page.

Are you sure? I looked at my Claude usage dashboard and design has its own usage bucket not tied to anything else.

Design usage shouldn't impact code usage.

Ok, well have AI write some table stakes for you in 10 minutes with 100% test coverage and only provide exactly what "table stakes" you are missing without any bells and whistles.

In this case, the author's NPM account was taken over, email address changed to one the attacker controls, and the package was manually published.

Since the attacker had full control of the NPM account, it is game over - the attacker can login to NPM and could, if they wanted, configure Trusted Publishing on any repo they control.

Axios IS using trusted publishing, but that didn't do anything to prevent the attack since the entire NPM account was taken over and config can be modified to allow publishing using a token.

Exact same for me - but I also use the shortcut to move windows between monitors.

I use cmd+tab and cmd+~ a ton also as I have multiple browser profiles and windows open and usually a few instances of ide with different projects.

And always close tabs with cmd+w and apps with cmd+q to avoid running apps with no visible windows.

I feel super productive with this workflow, never need to fiddle with manual resize.

When someone is screen sharing and they have a bunch of random sized windows it drives me crazy.

I recently listened to this episode from the Claude Code creator (here is the video version: https://www.youtube.com/watch?v=PQU9o_5rHC4) and it sounded like their development process was somewhat similar - he said something like their entire codebase has 100% churn every 6 months. But I would assume they have a more professional software delivery process.

I would (incorrectly) assume that a product like this would be heavily tested via AI - why not? AI should be writing all the code, so why would the humans not invest in and require extreme levels of testing since AI is really good at that?

Same. Why does it have a "belligerent" tag/badge - that seems to indicate bias.

But other than not understanding the data, the UI looks really fancy.

Same. Once in a while I end up on a screen share with someone and see that they have all these odd sized windows and they try to drag them around and resize them - drives me crazy!

Nice - I didn't know about that one!

I just found out today that hovering over the green traffic light icon shows an arrange menu... but the "maximize" option there leaves some padding on all sides of the window - weird.

I swear by https://rectangleapp.com/ - same outcome but with keyboard shortcuts instead of the mouse.

Not sure if it replaces everything, but I have been using https://rectangleapp.com and would not be able to use MacOS without it.

I use https://rectangleapp.com which has been a lifesaver. I only use the following three shortcuts and disable the rest:

cmd+option+f = maximize to fill entire screen

cmd+option+ctrl+left/right = move window to other monitor on left/right

I occasionally use cmd+option+left/right if I need to have two windows side-by-side on the same monitor.

MacOS window sizes have always felt weird to me - no easy way to maximize without making it go into full screen mode.

As I was writing this, I just realized that hovering on the green traffic light shows a menu to choose some window placement options.... not sure how I never realized this before, but even the "maximize" option there doesn't go all the way to the edges - weird.

The one time I was impressed with codex was when I was adding translations in a bunch of languages for a business document generation service. I used claude to do the initial work and cross checked with codex.

The codex agent ran for a long time and created and executed a bunch of python scripts (according to the output thinking text) to compare the translations and found a number of possible issues. I am not sure where the scripts were stored or executed, our project doesn't use python.

Then I fed the output of the issues codex found to claude for a second "opinion". Claude said that the feedback was obviously from someone that knew the native language very well and agreed with all the feedback.

I was really surprised at how long Codex was thinking and analyzing - probably 10 minutes. (This was ~1+mo ago, I don't recall exactly what model)

Claude is pretty decent IMO - amp code is better, but seems to burn through money pretty quick.

We have these in Whitefish Montana - it's foggy most of the time here which provides the moisture to create them.

https://skiwhitefish.com/ski-among-the-snow-ghosts-at-whitef...

The native vs code extension experience was just released a couple days ago, it is no longer a terminal wrapper.

All of the five searches I tried had Tennessee court documents as the top result, anyone else experience this?

We pay about $130/mo for water in north phoenix even if we don't use a drop.

Mitchell has a 5 min lightning talk discussing performance of ghostty which is worth a quick watch https://www.youtube.com/watch?v=cPaGkEesw20&t=3015s

It's one of those things that you don't realize how poor the performance is until you experience something better.

Mentioned from his blog: https://mitchellh.com/writing/ghostty-is-coming

Just use react.... That's what I do - it is so much easier than trying to fight with Next.js.

I have a large application and I use next.js for the landing pages (landing, tos, privacy, blog, login, etc..) - but for the core application after login, I just use vanilla react with react router. For me I keep these as separate applications as I don't want to load the entire app just for the landing page or login box.

Every time I need to work in the nextjs part of the app I always run into problems and have to read the docs and troubleshoot, sift through which part of the docs apply to my setup versus the app router.

If your entire application needs to be indexed as a static site (e.g. content based versus a web application), then vanilla react isn't a good fit - so it depends on your needs.

Unrelated - but shout out to https://nx.dev. I always prefer using this for all of my projects - made it super easy to have my node backend, react frontend, nextjs landing page, chrome extension, cron jobs, etc.. all in the same codebase where I can share code between all of them via non-publishable libraries.